US6189036B1 - User access to objects in group based access control based on result of greatest common divisor of assigned unique prime numbers of user and object - Google Patents

User access to objects in group based access control based on result of greatest common divisor of assigned unique prime numbers of user and object Download PDF

Info

Publication number
US6189036B1
US6189036B1 US09187070 US18707098A US6189036B1 US 6189036 B1 US6189036 B1 US 6189036B1 US 09187070 US09187070 US 09187070 US 18707098 A US18707098 A US 18707098A US 6189036 B1 US6189036 B1 US 6189036B1
Authority
US
Grant status
Grant
Patent type
Prior art keywords
access
group
object
user
number
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Expired - Fee Related
Application number
US09187070
Inventor
I-Lung Kao
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
International Business Machines Corp
Original Assignee
International Business Machines Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Grant date

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00Arrangements for program control, e.g. control units
    • G06F9/06Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46Multiprogramming arrangements
    • G06F9/468Specific access rights for resources, e.g. using capability register

Abstract

An access control mechanism using a grouping system whereby each group is assigned a unique prime number. The resource objects to be accessed are assigned a value that is determined by multiplying all of the group prime numbers from the groups that have access to that resource. Also, each user is assigned to one or more groups and each user has an access number that is a product of the prime numbers assigned to each group. When a particular user desires access to a particular resource object, the greatest common divisor between the resource product and the user product is determined. If the resulting greatest common divisor is greater than one, then the user is allowed access. If the greatest common divisor is one (the lowest prime), the user is denied access.

Description

BACKGROUND OF THE INVENTION

1. Technical Field

The present invention relates generally to access control in computer systems and, in particular, to the use of prime numbers to facilitate group based access control to information resources in the computer system.

2. Description of the Related Art

Group based access control is an access control model in which the authorization to access an object from a user is based on some group information associated with the user and/or the object. This model is commonly employed in popular operating systems, database managers, special-purpose applications, and cross-platform computing infrastructures (e.g., The Open Group Distributed Computing Environment or DCE), due to its close fit human organizational structures. Implementation of this model, however, often results in a large amount of overhead in storage, operation, and administration.

The known group based access control paradigm involves users, groups, and information resource objects. A user is the entity who can access an object with some operations. Each user typically belongs to a number of groups. A group is the entity solely defined for the purpose of access control. Each group typically contains as its members a number of users. An object is the entity that can be accessed by a user. Each object can be accessed with a number of operations, depending upon the object's type. Access control on each operation of an object is group based, i.e. whether a user can access an object with an operation depends upon the groups to which the user belongs. Therefore, each object needs to be associated with some access control information that indicates what group of users are allowed to access the object and in what ways (operations).

The traditional and most commonly used mechanism to implement this model is by an Access Control List (ACL). In this known scheme, each object is associated with an ACL that either lists, for each defined access operation, all the groups that are allowed to access the object (a so-called per-operation based ACL) or lists, for each group that is allowed to access the object, all the operations the group can perform (a so-called per-group based ACL). Each group is also associated with a member list that lists all the users belonging to the group. For ease of user administration, each user can also be associated with a group list that lists all the groups to which the user belongs.

In an enterprise environment whose computing systems and applications employ an ACL group based access control mechanism, each operation request from a user to access an object is potentially expensive. This is because the access control modules of these systems and applications need to traverse the whole ACL associated with the object for that access operation and then check if the user belongs to any one of the groups. Such checking may require traversal of the whole member list of each group or the whole group list of the user. The object authorization is costly at run time (especially the I/O operation to load the ACL from persistent storage to volatile memory), and this mechanism also requires a significant amount of space to store ACLs off-line.

Moreover, multiple groups may require access to multiple resources creating a compound and complex access list problem. For each user, a list must be stored listing each group to which the user belongs. Also, for each resource, a list must be stored listing each group which has access to that resource. It is known in the art to assign a prime number to each group, and the access list for resources and the group list for users may be stored as multipliers of these groups of primes. This approach provides an easy storage method, but prior art techniques require computationally intensive methods for decomposing the multipliers to their primes to determine whether a prime number is present on both the users group list and the resources group access list. This technique is illustrated, for example, by Hwang et al. in an article titled “A New Access Control Method Using Prime Factorisation,” the Computer Law Journal, Volume 35, No. 1, 1992.

Another known access control technique is to use a prime number assigned to each information resource object. The user is then assigned a number that is a multiple of all of those prime numbers encompassing all access authorities for that user. The determination of whether that particular user has access to a particular resource object is then determined by dividing the prime number assigned to the resource into the access product for the user. If the result is an integer, then access is granted because the prime number for that resource group must be one of the prime numbers used for the access product. This approach, however, is computationally inefficient and also creates a significant administrative burden. In particular, determining every single resource to which a user is entitled access in a system with a large number of resources requires system administrators to tag all of these resources to create the resource access multiplier. In a large system, this technique is simply not feasible.

There remains a need to provide new and efficient techniques for group based access control to information resource objects that do not require ACLs, computationally intensive parsing of prime multiplication factors, or other inefficient or expensive schemes. The present invention solves this important problem.

BRIEF SUMMARY OF THE INVENTION

It is a primary object of the present invention to provide an improved group based access control mechanism.

It is another primary object of this invention to facilitate group based access to information resource objects within a computer system using a simple numerical computation based on prime numbers.

It is still another object of this invention to supplant or supplement the Access Control Lists (ACLs) used to implement a group based access control mechanism.

Yet another object of this invention is to reduce the administration costs associated with known group based access control methods.

It is still another important object of this invention to expedite group based access control to information resource objects in an enterprise environment whose computing systems and applications typically employ an ACL based access control mechanism.

Still another object of the present invention is to enhance the performance and reduce the cost of group based access control in a computer enterprise environment.

These and other objects of the present invention are achieved using an efficient group based access control mechanism based on prime numbers. The efficiency of this inventive scheme results from a unique property of prime numbers. The scheme may be used to completely replace the traditional ACL based access control mechanism or the technique may be integrated to the existing ACL based mechanism to expedite the authorization process.

The described embodiment of the present invention provides an access control system using a grouping system whereby each group is assigned a prime number greater than one. The resources to be accessed are assigned a product that is determined by multiplying all of the group prime numbers from the groups which have access to that resource. Also, each user is assigned to one or more groups and each user has an access number that is a product of the prime numbers assigned to each group. When a particular user desires access to a particular information resource object, the greatest common devisor between the resource product and the user product is determined. If the resulting greatest common devisor is greater than one, then the user is allowed access. If the greatest common devisor is one (the lowest prime), the user is denied access.

Generalizing, the present invention is implemented in a group based access control mechanism wherein each of a plurality of access control groups has an associated group number and a set of one or more users assigned thereto. In particular, a method for controlling access to objects begins by associating each group's group number with a unique prime number. Thereafter, the method assigns each user a user number that is a product of the group numbers (namely, the primes) for the groups to which the user is assigned. Each object is then assigned an object number that is a product of the group numbers (namely, the primes) of the groups having access to the object. To determine whether a given user may access a given object, the method evaluates a greatest common divisor of the given user's user number and the given object's object number. The given user is permitted access to the given object if the greatest common divisor is greater than a predetermined value (namely, one) indicating that the user number and the object number have no common factors. On the contrary, the given user is denied access to the given object if the greatest common divisor is the predetermined value. In one embodiment, the greatest common divisor is evaluated using a known function, such as Euclid's algorithm.

The foregoing has outlined some of the more pertinent objects and features of the present invention. These objects should be construed to be merely illustrative of some of the more prominent features and applications of the invention. Many other beneficial results can be attained by applying the disclosed invention in a different manner or modifying the invention as will be described. Accordingly, other objects and a fuller understanding of the invention may be had by referring to the following Detailed Description of the Preferred Embodiment.

BRIEF DESCRIPTION OF THE DRAWINGS

For a more complete understanding of the present invention and the advantages thereof, reference should be made to the following Detailed Description taken in connection with the accompanying drawings in which:

FIG. 1 is a simplified diagram of the component types of a group based access control model;

FIG. 2 is a flowchart of an illustrative embodiment of the present invention;

FIG. 3 is a representative group based access control model in which the present invention is implemented;

FIG. 4 is a table illustrating the group numbers and the group attributes of the users and objects identified in FIG. 3; and

FIG. 5 is a further illustrative example of the invention as applied to a particular group based access control model.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT

The inventive access control method may be implemented within a given computer system. As is well-known, access control protects the privacy and integrity of information resource objects in the computer system. Typically, such objects comprise files, programs, memory segments, processor cycles, devices, or the like. The control method preferably is implemented within a known “group based” access control model.

As illustrated in FIG. 1, the known group based access control model involves three (3) types of entities: user 10, group 12, and object 14. A user is the entity who can access an object with some operations. Each user typically belongs to a number of groups. A group is the entity solely defined for the purpose of access control. Each group typically contains as its members a number of users. An object is the entity that can be accessed by a user. Each object can be accessed with a number of operations, depending upon the object's type. Thus, for example, a “file” object is accessed by one of the create/read/write/execute/remove operations, while a “database record” object is accessed by one of the add/modify/search/compare/delete operations. Access control on each operation of an object is group based, i.e. whether a user can access an object with an operation depends upon the groups to which the user belongs. Therefore, each object needs to be associated. with some access control information that indicates what group of users are allowed to access the object and in what ways (operations).

Therefore, a common technique to minimize the burden on an administrative staff is to assign the users to groups. Groups are administratively convenient because it is common that large numbers of users will have common access needs. Therefore, by assigning a user to a particular group, the systems administrator can provide access to a large number of resources that are grouped together because of common needs.

A representative computer system in which the present invention is implemented comprises one or more client machines connected to one or more servers across a computer network. A representative computer includes an x86-, PowerPC®- or RISC-based processor, an operating system such as IBM® OS/2® or Microsoft Windows '95, RAM storage, disk storage, input/output devices (e.g., a keyboard, display, mouse, printer, etc.), various application programs, communications devices, and other known hardware, software, network operating systems and the like. The present invention may be conveniently implemented in software, namely, as a series of computer instructions that effect the various functions described below.

FIG. 2 illustrates a flowchart of one preferred method for controlling access to information resource objects within a computer system that is operative within an group based access control model. At step 20, and for each of a plurality of access groups to which one or more users are assigned, the method begins by associating each access group's group number with a unique prime number greater than one. At step 22, each user is assigned a user number that is a product of the group numbers (namely, the unique prime numbers) for the groups to which the user is assigned. At step 24, each information resource object is assigned an object number that is a product of the group numbers (namely, the unique prime numbers) of the groups having access to the object. Steps 22 and 24 may be reversed. At step 26, a test is run to determine whether a given user desires to access a given information object. If the outcome of the test at step 26 is negative, the routine cycles. If, however, the outcome of the test at step 26 is positive, the routine continues at step 28 to determine the greatest common divisor between the given user's user number and the given object's object number. At step 30, a test is performed to determine if the greatest common divisor is greater than or equal to one (the lowest possible prime). If the greatest common divisor is greater one, the routine branches to step 32 to permit access to the information resource object. If the greatest common divisor is one, the routine continues at step 34 to deny the given user access to the information resource object.

Thus, according to the described embodiment of the present invention, an access control method uses a grouping system whereby each group is assigned a prime number greater than one. Resource objects to which a group has access are assigned an object number that is determined by multiplying all group prime numbers from the groups that have access to that resource object. Also, each user is assigned to one or more groups. Each user has a user number that is a product of the prime numbers assigned to each group. When a particular user desires to have access to a particular resource object, the greatest common divisor between the resource object number and the user number is determined. If the resulting greatest common denominator is greater than one, then access is granted. If the greatest common divisor is one, then access is denied.

The following is a detailed description of the data that is preferably created for each entity (user, group, object) to support the inventive mechanism.

Each group Gi is assigned a unique “group number”, PGi, which must be a prime. Each user Ui is associated with a user number or “group attribute”, MUi, which is a multiple of the PGi's of all the groups to which the user belongs. That is, MUi=PG1*PG2*PG3* . . . *PGk, where G1, G2, G3, . . . , Gk are all the groups to which the user belongs. Each access operation A of an object Oi is associated with an object number or “group attribute”, MOi A, which is a multiple of the PGi's of all the groups that are allowed to perform access operation A on the object Oi. That is, MOi A=PG1*PG2*PG3* . . . *PGk, where G1, G2, G3, . . . , Gk are all the groups whose members are allowed to perform the access operation A on the object.

According to the present invention, various access control activities are performed efficiently using this data. Each access control activity is described by one question, depending on the information already known, as now described.

The question of “whether a user Ui belongs to a group Gi?” can be answered easily by just testing if PGi divides MUi. This is helpful when it is already known that an object Oi is accessible by group Gi, and, in such case, whether user Ui can access object Oi depends on whether user Ui is a member of group Gi.

The question of “whether an object Oi can be accessed with an operation A by a group Gi?” can be answered easily by just testing if PGi divides MOi A. This is helpful when it is already known that a user Ui belongs to group Gi, and, in such case, whether user Ui can access object Oi with operation A depends on whether object Oi can be accessed with operation A by group Gi.

A more general question is “whether a user Ui belongs to a group Gi which is allowed to perform an access operation A on an object Oi?”. The intuitive way based on the first approach above is to first enumerate all the groups that can access object Oi with operation A (therefore one needs to keep all the group information with the object) and then check if PGi of any group divides MUi. The intuitive way based on the second approach above is to first enumerate all the groups the user belongs to (therefore one needs to keep all the group information with the user) and then check if PGi of any group divides MOi A. Either way requires storing detailed group information with either each user or each object and enumerating all the groups of a user or an object when an access request is made.

According to the present invention, this question is answered in a computationally efficient manner by obtaining the GCD (Greatest Common Divisor) of MUi of the user and MOi A of the object. If GCD(MUi, MOi A) is any number greater than 1 (which means MUi and MOi A have common factors), the user is allowed to access the object. If, however, GCD(MUi, MOi A) is 1 (which means MUi and MOi A have no common factors), the user's access request is denied.

FIG. 3 illustrates a representative group based access control model. This particular model assumes there are four users (U1, U2, U3, and U4), three groups (G1, G2 and G3), and two objects (O1 and O2). The group membership information and access control information is shown by the links among various entities in the drawing. The group numbers of the groups and the group attributes of the users and objects are set forth in FIG. 4 (for the reason of simplicity, it is assumed there is only one access operation with an object or all the access operations of an object share the same group attribute).

Returning to the example questions set forth above, one of ordinary skill will appreciate that the first two questions can be answered quickly by the solutions stated. To demonstrate how the solution of the third question works, it is assumed U1 attempts to access to O2. This access request, however, will be denied because GCD(MU1, MO2)=1. However, if U4 attempts to access to O1, its access request will be authorized since GCD(MU4, MO1)=6.

The are several well-known and efficient algorithms (e.g., Euclid's algorithm) that compute the GCD of two numbers a and b in only O(log(min(a, b))) time. Euclid's theorem states that the greatest common denominator of two numbers a and b is equal to the greatest common divisor or denominator of the smaller of the two numbers and the remainder when the smaller of the two numbers is divided into the larger of the two numbers. This algorithm is set forth below for the numbers a and b:

(define (GCD a b)(if (=b 0)a(GCD b (remainder a b)))).

This routine generates an iterative process, whose number of steps grows as the logarithm of the numbers involved.

For example, assume a is equal to 206, and b is equal to 40. Then GCD(206,40)=GCD(40,6). Forty is divided into 206 five times with the remainder of 6. This operation is then applied to GCD(40,6). Six goes into 40 six times with a remainder of 4, so GCD(40,6)=GCD(6,4). This process is applied again to determine that GCD(6,4)=GCD(4,2), which is equal to GCD(2,0). Thus, the greatest common divisor of 206 and 40 is 2.

This analysis may be readily applied to a concrete example as illustrated in FIG. 5. In this example, G1, G2 and G3 are 2, 3 and 5, respectively, and thus U1, U2, U3, and U4), are 2, 6, 3 and 30, respectively. The two objects O1 and O2 are 6 and 15, respectively. Continuing with the above example, assume user U4 desires to access object O2. Using Euclid's theorem, GCD(30,15)=GCD(15,0). Thus, the greatest common divisor between the user number of U4 and resource object number O2 is 15. As this number is greater than 1, access is allowed for U4. On the other hand, assume user U1, desires to access resource O2; Euclid's theorem thus is calculated as follows: GCD(15,2)=GCD(2,1)=GCD(1,0). Therefore, the greatest common divisor between the user number for U1, and the resource object for O2 is 1. Therefore, access to resource O2 is denied to U1.

The present invention provides numerous advantages over the traditional ACL based mechanism. The technique exhibits substantial better performance. In particular, each object authorization based on group information is much more efficient with the new mechanism. This is because a simple numerical computation takes much less time than loading a potential long ACL and performing (group name) string comparisons. Moreover, the present invention requires less storage as each user and object preferably is associated with a single integer (group attribute) instead of a lengthy group list or ACL (to represent its group information).

Further, the inventive scheme has lower administration costs than the prior art. Specifically, the process to achieve group administration for users is relatively inexpensive. Adding a user Ui to a group Gi can be done by simply multiplying the user's group attribute (MUi) by the group's group number (PGi), and removing a user Ui from a group Gi can be done by simply dividing MUi by PGi. Similarly, the process to achieve access control administration for objects is also low-cost. Granting a group Gi an access A to an object Oi and revoking a group's access to an object can be easily done by multiplying MOi A by PGi and dividing MOi A by PGi, respectively.

Finally, the present invention is advantageous because it may coexist with traditional ACL mechanism. This is highly beneficial in situations where it may not be desired to completely replace the original ACL based mechanism within existing systems and application (maybe for other administration purposes). In such case, significant performance advantages are still available by just complementing the ACL based mechanism with the inventive prime based mechanism, at a minimal cost.

Although the invention has been shown and described with reference to particular embodiments thereof, it will be understood by those skilled in the art that the invention can be practiced, with modification, in other environments. For example, although the invention described above can be conveniently implemented in a general purpose computer selectively reconfigured or activated by software, those skilled in the art would, recognize that the invention could be carried out in hardware, in firmware or in any combination of software, firmware or hardware including a special purpose apparatus specifically designed to perform the described invention. Therefore, changes in form and detail may be made therein without departing from the spirit and scope of the invention as set forth in the accompanying claims.

One of the preferred implementations of the invention is as a set of instructions (program code) in a code module resident in the random access memory of the computer. Until required by the computer, the set of instructions may be stored in another computer memory, for example, in a hard disk drive, or in a removable memory such as an optical disk (for eventual use in a CD ROM) or floppy disk (for eventual use in a floppy disk drive), or downloaded via the Internet or other computer network.

Although the present invention has been illustrated with respect to a preferred embodiment, the inventive technique is not limited to any particular purpose of the access request, as there may be many different types and reasons to access a given information resource object (any of which may use the authorization scheme). Thus, the particular access request or operation to be performed on the information resource object is not a limitation of the present invention.

Claims (20)

Having thus described my invention, what I claim as new and desire to secure by Letters Patent is set forth in the following claims:
1. In a group based access control mechanism wherein each of a plurality of access control groups has an associated group number and a set of one or more users assigned thereto, a method for controlling access to objects, comprising the steps of:
associating each group's group number with a unique prime number;
assigning each user a user number that is a given function of the group numbers for the groups to which the user is assigned;
assigning each object an object number that is a given function of the group numbers of the groups having access to the object; and
determining a greatest common divisor of a given user's user number and a given object's object number to determine whether the given user may access the given object.
2. The method as described in claim 1 wherein the given function is a product.
3. The method as described in claim 1 further including the step of:
permitting the given user to access the given object if the greatest common divisor is greater than a predetermined value indicating that the user number and the object number have no common factors.
4. The method as described in claim 3 wherein the given object is a file.
5. The method as described in claim 4 wherein the given object is accessed for a given operation selected from the set of operations consisting essentially of create, read, write, execute and remove.
6. The method as described in claim 1 further including the step of:
denying the given user access to the given object if the greatest common divisor is the predetermined value.
7. The method as described in claim 1 wherein the greatest common divisor is evaluated using Euclid's theorem.
8. A method for controlling access to objects, comprising the steps of:
for each of a plurality of access groups to which one or more users are assigned, associating each access group's group number with a unique prime number;
assigning each user a user number that is a product of the group numbers for the groups to which the user is assigned;
assigning each object an object number that is a product of the group numbers of the groups having access to the object;
permitting a given user to access a given object if a numerical computation derived from the given user's user number and the given object's object number is a predetermined value.
9. The method as described in claim 8 wherein the numerical computation generates a greatest common divisor of the given user's user number and the given object's object number.
10. A computer program product in a computer readable medium for use in a group based access control mechanism wherein each of a plurality of access control groups has an associated group number and a set of one or more users assigned thereto, the computer program product comprising:
means for associating each group's group number with a unique prime number greater than one;
means for assigning each user a user number that is a product of the group numbers for the groups to which the user is assigned;
means for assigning each object an object number that is a product of the group numbers of the groups having access to the object; and
means for determining a greatest common divisor of a given user's user number and a given object's object number to determine whether the given user may access the given object.
11. The computer program product as described in claim 10 further including:
means for permitting the given user to access the given object if the greatest common divisor is greater than a predetermined value indicating that the user number and the object number have no common factors.
12. The computer program product as described in claim 10 further including:
means for denying the given user access to the given object if the greatest common divisor is the predetermined value.
13. The computer program product as described in claim 10 wherein the greatest common divisor is evaluated using a numerical computation.
14. The computer program product as described in claim 13 wherein the numerical computation is Euclid's algorithm.
15. In a group based access control mechanism wherein each of a plurality of access control groups has an associated group number and a set of one or more users assigned thereto, the improvement comprising:
means for associating each group's group number with a unique prime number greater than one;
means for assigning each user a user number that is a product of the group numbers for the groups to which the user is assigned;
means for assigning each object an object number that is a product of the group numbers of the groups having access to the object; and
means for evaluating a greatest common divisor of a given user's user number and a given object's object number to determine whether the given user may access the given object.
16. In the group based access control mechanism of claim 15, wherein the improvement further includes:
means for permitting the given user to access the given object if the greatest common divisor is greater than a predetermined value indicating that the user number and the object number have no common factors.
17. In the group based access control mechanism of claim 15, wherein the improvement further includes:
means for denying the given user access to the given object if the greatest common divisor is the predetermined value.
18. A group based access control mechanism wherein each of a plurality of access control groups has an associated group number and a set of one or more users assigned thereto, comprising:
means for associating each group's group number with a unique prime number greater than one;
means for assigning each user a user number that is a product of the group numbers for the groups to which the user is assigned;
means for assigning each object an object number that is a product of the group numbers of the groups having access to the object;
means for evaluating a greatest common divisor of a given user's user number and a given object's object number; and
means for permitting the given user to access the given object if the greatest common divisor is greater than a predetermined value indicating that the user number and the object number have no common factors.
19. A method for managing a group, comprising the steps of:
for each of a plurality of access groups to which one or more users are assigned, associating each access group's group number with a unique prime number PGi;
assigning each user a number MUi that is a product of the group numbers for the groups to which the user is assigned;
assigning each object Oi a number MOi A that is a product of the group numbers of the groups having access to the object;
determining whether a given user Ui belongs to a given group Gi by testing if PGi divides MUi.
20. A method of managing a group, comprising the steps of:
for each of a plurality of access groups to which one or more users are assigned, associating each access group's group number with a unique prime number PGi;
assigning each user a number MUi that is a product of the group numbers for the groups to which the user is assigned;
assigning each object a number MOi A that is a product of the group numbers of the groups having access to the object;
determining whether an object Oi can be accessed with an operation by a group Gi by testing if PGi divides MOi A.
US09187070 1998-11-05 1998-11-05 User access to objects in group based access control based on result of greatest common divisor of assigned unique prime numbers of user and object Expired - Fee Related US6189036B1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US09187070 US6189036B1 (en) 1998-11-05 1998-11-05 User access to objects in group based access control based on result of greatest common divisor of assigned unique prime numbers of user and object

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
US09187070 US6189036B1 (en) 1998-11-05 1998-11-05 User access to objects in group based access control based on result of greatest common divisor of assigned unique prime numbers of user and object

Publications (1)

Publication Number Publication Date
US6189036B1 true US6189036B1 (en) 2001-02-13

Family

ID=22687498

Family Applications (1)

Application Number Title Priority Date Filing Date
US09187070 Expired - Fee Related US6189036B1 (en) 1998-11-05 1998-11-05 User access to objects in group based access control based on result of greatest common divisor of assigned unique prime numbers of user and object

Country Status (1)

Country Link
US (1) US6189036B1 (en)

Cited By (37)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030041198A1 (en) * 2001-08-23 2003-02-27 International Business Machines Corporation Authorization model for administration
US20030220946A1 (en) * 2002-05-21 2003-11-27 Malik Dale W. Resource list management system
US20030220975A1 (en) * 2002-05-21 2003-11-27 Malik Dale W. Group access management system
US20040003084A1 (en) * 2002-05-21 2004-01-01 Malik Dale W. Network resource management system
US20040019505A1 (en) * 2000-02-24 2004-01-29 Bowman Bradley R. Personalized health communication system
US20040034833A1 (en) * 1999-11-12 2004-02-19 Panagiotis Kougiouris Dynamic interaction manager for markup language graphical user interface
US20040034686A1 (en) * 2000-02-22 2004-02-19 David Guthrie System and method for delivering targeted data to a subscriber base via a computer network
US20040039993A1 (en) * 1999-10-12 2004-02-26 Panagiotis Kougiouris Automatic formatting and validating of text for a markup language graphical user interface
US20040044548A1 (en) * 2000-02-24 2004-03-04 Marshall Philip D. Personalized health history system with accommodation for consumer health terminology
US20040093515A1 (en) * 2002-11-12 2004-05-13 Microsoft Corporation Cross platform network authentication and authorization model
US20040111645A1 (en) * 2002-12-05 2004-06-10 International Business Machines Corporation Method for providing access control to single sign-on computer networks
US20040168090A1 (en) * 1999-10-12 2004-08-26 Webmd Corp. System and method for delegating a user authentication process for a networked application to an authentication agent
US20040215695A1 (en) * 2003-03-31 2004-10-28 Sue-Chen Hsu Method and system for implementing accurate and convenient online transactions in a loosely coupled environments
US20050004895A1 (en) * 1999-12-01 2005-01-06 Webmd Corp. System and method for implementing a global master patient index
US20050028171A1 (en) * 1999-11-12 2005-02-03 Panagiotis Kougiouris System and method enabling multiple processes to efficiently log events
US20060004607A1 (en) * 2000-02-24 2006-01-05 Philip Marshall Personalized health history system with accommodation for consumer health terminology
US20060265438A1 (en) * 2005-05-20 2006-11-23 Microsoft Corporation Leveraging garbage collection to dynamically infer heap invariants
US20060294103A1 (en) * 2005-06-28 2006-12-28 Wood Douglas A Security and authorization in management agents
US20070073797A1 (en) * 2005-09-29 2007-03-29 Lockheed Martin Corporation Recursive method for solving the inexact greatest common divisor problem
US20070244942A1 (en) * 2006-04-17 2007-10-18 Microsoft Corporation Using dynamic analysis to improve model checking
US7305475B2 (en) 1999-10-12 2007-12-04 Webmd Health System and method for enabling a client application to operate offline from a server
US20080005208A1 (en) * 2006-06-20 2008-01-03 Microsoft Corporation Data structure path profiling
US20080162484A1 (en) * 2006-12-27 2008-07-03 Ryo Yoshida Technique for controlling access to data
US20080215367A1 (en) * 2007-02-02 2008-09-04 Webmd Health Personalized Health Records with Associative Relationships
US20090006352A1 (en) * 2005-09-14 2009-01-01 Dettinger Richard D Composing abstract queries for delegated user roles
US7536392B2 (en) 2002-05-21 2009-05-19 At&T Intelllectual Property I, L.P. Network update manager
US20090187964A1 (en) * 2008-01-18 2009-07-23 I-Lung Kao Applying Security Policies to Multiple Systems and Controlling Policy Propagation
US20100115281A1 (en) * 2008-08-28 2010-05-06 International Business Machines Corporation Attributes in cryptographic credentials
US20100180339A1 (en) * 2007-05-18 2010-07-15 Secure Keys Pty Limited Security token and system and method for generating and decoding the security token
US20110185395A1 (en) * 2010-01-25 2011-07-28 Fuji Xerox Co., Ltd. Computer readable medium for access right management, access right management apparatus and data processing system
US8046752B2 (en) 2002-11-25 2011-10-25 Microsoft Corporation Dynamic prefetching of hot data streams
US20110259960A1 (en) * 2010-04-08 2011-10-27 Access Business Group International Llc Point of sale inductive systems and methods
US8180787B2 (en) 2002-02-26 2012-05-15 International Business Machines Corporation Application portability and extensibility through database schema and query abstraction
US8296162B1 (en) 2005-02-01 2012-10-23 Webmd Llc. Systems, devices, and methods for providing healthcare information
US20150058605A1 (en) * 2013-08-21 2015-02-26 Vmware, Inc. Branch trace compression
US9141633B1 (en) * 2012-06-27 2015-09-22 Emc Corporation Special markers to optimize access control list (ACL) data for deduplication
US9811513B2 (en) 2003-12-09 2017-11-07 International Business Machines Corporation Annotation structure type determination

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4611272A (en) 1983-02-03 1986-09-09 International Business Machines Corporation Key-accessed file organization
US5113442A (en) 1989-03-06 1992-05-12 Lachman Associates, Inc. Method and apparatus for providing access control in a secure operating system
US5335346A (en) * 1989-05-15 1994-08-02 International Business Machines Corporation Access control policies for an object oriented database, including access control lists which span across object boundaries
US5584022A (en) 1992-12-03 1996-12-10 Fujitsu Limited Enciphered file sharing method
US5675782A (en) * 1995-06-06 1997-10-07 Microsoft Corporation Controlling access to objects on multiple operating systems
US5696898A (en) * 1995-06-06 1997-12-09 Lucent Technologies Inc. System and method for database access control
US5991807A (en) * 1996-06-24 1999-11-23 Nortel Networks Corporation System for controlling users access to a distributive network in accordance with constraints present in common access distributive network interface separate from a server

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4611272A (en) 1983-02-03 1986-09-09 International Business Machines Corporation Key-accessed file organization
US5113442A (en) 1989-03-06 1992-05-12 Lachman Associates, Inc. Method and apparatus for providing access control in a secure operating system
US5335346A (en) * 1989-05-15 1994-08-02 International Business Machines Corporation Access control policies for an object oriented database, including access control lists which span across object boundaries
US5584022A (en) 1992-12-03 1996-12-10 Fujitsu Limited Enciphered file sharing method
US5675782A (en) * 1995-06-06 1997-10-07 Microsoft Corporation Controlling access to objects on multiple operating systems
US5696898A (en) * 1995-06-06 1997-12-09 Lucent Technologies Inc. System and method for database access control
US5991807A (en) * 1996-06-24 1999-11-23 Nortel Networks Corporation System for controlling users access to a distributive network in accordance with constraints present in common access distributive network interface separate from a server

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
Hwang, J., "A New Access Control Method Using Prime Factorisation", The Computer Journal, 1992, vol. 35, No. 1, pp. 16-20.

Cited By (74)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070219991A1 (en) * 1999-02-22 2007-09-20 David Guthrie System and method for delivering targeted data to a subscriber base via a computer network
US20040039993A1 (en) * 1999-10-12 2004-02-26 Panagiotis Kougiouris Automatic formatting and validating of text for a markup language graphical user interface
US7305475B2 (en) 1999-10-12 2007-12-04 Webmd Health System and method for enabling a client application to operate offline from a server
US7519905B2 (en) 1999-10-12 2009-04-14 Webmd Corp. Automatic formatting and validating of text for a markup language graphical user interface
US20040168090A1 (en) * 1999-10-12 2004-08-26 Webmd Corp. System and method for delegating a user authentication process for a networked application to an authentication agent
US7877492B2 (en) * 1999-10-12 2011-01-25 Webmd Corporation System and method for delegating a user authentication process for a networked application to an authentication agent
US20040034833A1 (en) * 1999-11-12 2004-02-19 Panagiotis Kougiouris Dynamic interaction manager for markup language graphical user interface
US20050028171A1 (en) * 1999-11-12 2005-02-03 Panagiotis Kougiouris System and method enabling multiple processes to efficiently log events
US20050004895A1 (en) * 1999-12-01 2005-01-06 Webmd Corp. System and method for implementing a global master patient index
US7725331B2 (en) 1999-12-01 2010-05-25 Webmd Corporation System and method for implementing a global master patient index
US20040034686A1 (en) * 2000-02-22 2004-02-19 David Guthrie System and method for delivering targeted data to a subscriber base via a computer network
US20040044548A1 (en) * 2000-02-24 2004-03-04 Marshall Philip D. Personalized health history system with accommodation for consumer health terminology
US20040019505A1 (en) * 2000-02-24 2004-01-29 Bowman Bradley R. Personalized health communication system
US8775197B2 (en) 2000-02-24 2014-07-08 Webmd, Llc Personalized health history system with accommodation for consumer health terminology
US8712792B2 (en) 2000-02-24 2014-04-29 Webmd, Llc Personalized health communication system
US8612245B2 (en) 2000-02-24 2013-12-17 Webmd Llc Personalized health history system with accommodation for consumer health terminology
US20060004607A1 (en) * 2000-02-24 2006-01-05 Philip Marshall Personalized health history system with accommodation for consumer health terminology
US20030041198A1 (en) * 2001-08-23 2003-02-27 International Business Machines Corporation Authorization model for administration
US6910041B2 (en) 2001-08-23 2005-06-21 International Business Machines Corporation Authorization model for administration
US8180787B2 (en) 2002-02-26 2012-05-15 International Business Machines Corporation Application portability and extensibility through database schema and query abstraction
US7831664B2 (en) 2002-05-21 2010-11-09 At&T Intellectual Property I, Lp Resource list management system
US7263535B2 (en) 2002-05-21 2007-08-28 Bellsouth Intellectual Property Corporation Resource list management system
US7346696B2 (en) * 2002-05-21 2008-03-18 At&T Deleware Intellectual Property, Inc. Group access management system
US20040003084A1 (en) * 2002-05-21 2004-01-01 Malik Dale W. Network resource management system
US20030220975A1 (en) * 2002-05-21 2003-11-27 Malik Dale W. Group access management system
US20070288573A1 (en) * 2002-05-21 2007-12-13 At&T Bls Intellectual Property, Inc. Resource List Management System
US20030220946A1 (en) * 2002-05-21 2003-11-27 Malik Dale W. Resource list management system
US7536392B2 (en) 2002-05-21 2009-05-19 At&T Intelllectual Property I, L.P. Network update manager
US20110022671A1 (en) * 2002-05-21 2011-01-27 Malik Dale W Resource List Management System
US20080168566A1 (en) * 2002-05-21 2008-07-10 At&T Delaware Intellectual Property, Inc., Formerly Known As Bellsouth Intl. Prop. Corp. Group access management system
US8166110B2 (en) 2002-05-21 2012-04-24 At&T Intellectual Property I, L.P. Resource list management system
US20040093515A1 (en) * 2002-11-12 2004-05-13 Microsoft Corporation Cross platform network authentication and authorization model
US7178163B2 (en) * 2002-11-12 2007-02-13 Microsoft Corporation Cross platform network authentication and authorization model
US8046752B2 (en) 2002-11-25 2011-10-25 Microsoft Corporation Dynamic prefetching of hot data streams
US7389430B2 (en) * 2002-12-05 2008-06-17 International Business Machines Corporation Method for providing access control to single sign-on computer networks
US7702914B2 (en) 2002-12-05 2010-04-20 International Business Machines Corporation Method for providing access control to single sign-on computer networks
US20080216164A1 (en) * 2002-12-05 2008-09-04 Baffes Paul T Method for providing access control to single sign-on computer networks
US20040111645A1 (en) * 2002-12-05 2004-06-10 International Business Machines Corporation Method for providing access control to single sign-on computer networks
US20040215695A1 (en) * 2003-03-31 2004-10-28 Sue-Chen Hsu Method and system for implementing accurate and convenient online transactions in a loosely coupled environments
US9811513B2 (en) 2003-12-09 2017-11-07 International Business Machines Corporation Annotation structure type determination
US8296162B1 (en) 2005-02-01 2012-10-23 Webmd Llc. Systems, devices, and methods for providing healthcare information
US8694336B1 (en) 2005-02-01 2014-04-08 Webmd, Llc Systems, devices, and methods for providing healthcare information
US7912877B2 (en) 2005-05-20 2011-03-22 Microsoft Corporation Leveraging garbage collection to dynamically infer heap invariants
US20060265438A1 (en) * 2005-05-20 2006-11-23 Microsoft Corporation Leveraging garbage collection to dynamically infer heap invariants
US20060294103A1 (en) * 2005-06-28 2006-12-28 Wood Douglas A Security and authorization in management agents
US7624432B2 (en) 2005-06-28 2009-11-24 International Business Machines Corporation Security and authorization in management agents
US20090006352A1 (en) * 2005-09-14 2009-01-01 Dettinger Richard D Composing abstract queries for delegated user roles
US9679031B2 (en) * 2005-09-14 2017-06-13 International Business Machines Corporation Composing abstract queries for delegated user roles
US20070073797A1 (en) * 2005-09-29 2007-03-29 Lockheed Martin Corporation Recursive method for solving the inexact greatest common divisor problem
US7962901B2 (en) 2006-04-17 2011-06-14 Microsoft Corporation Using dynamic analysis to improve model checking
US20070244942A1 (en) * 2006-04-17 2007-10-18 Microsoft Corporation Using dynamic analysis to improve model checking
US20080005208A1 (en) * 2006-06-20 2008-01-03 Microsoft Corporation Data structure path profiling
US7926043B2 (en) * 2006-06-20 2011-04-12 Microsoft Corporation Data structure path profiling
US20080162484A1 (en) * 2006-12-27 2008-07-03 Ryo Yoshida Technique for controlling access to data
US8949202B2 (en) * 2006-12-27 2015-02-03 International Business Machines Corporation Technique for controlling access to data
US8380530B2 (en) 2007-02-02 2013-02-19 Webmd Llc. Personalized health records with associative relationships
US20080215367A1 (en) * 2007-02-02 2008-09-04 Webmd Health Personalized Health Records with Associative Relationships
US8756077B2 (en) 2007-02-02 2014-06-17 Webmd, Llc Personalized health records with associative relationships
US8752207B2 (en) * 2007-05-18 2014-06-10 Secure Keys Pty Limited Security token and system and method for generating and decoding the security token
US20100180339A1 (en) * 2007-05-18 2010-07-15 Secure Keys Pty Limited Security token and system and method for generating and decoding the security token
US20090187964A1 (en) * 2008-01-18 2009-07-23 I-Lung Kao Applying Security Policies to Multiple Systems and Controlling Policy Propagation
US8296820B2 (en) * 2008-01-18 2012-10-23 International Business Machines Corporation Applying security policies to multiple systems and controlling policy propagation
US20100115281A1 (en) * 2008-08-28 2010-05-06 International Business Machines Corporation Attributes in cryptographic credentials
US8819439B2 (en) 2008-08-28 2014-08-26 International Business Machines Corporation Attributes in cryptographic credentials
US8281131B2 (en) * 2008-08-28 2012-10-02 International Business Machines Corporation Attributes in cryptographic credentials
US8302207B2 (en) * 2010-01-25 2012-10-30 Fuji Xerox Co., Ltd. Computer readable medium for access right management, access right management apparatus and data processing system
US20110185395A1 (en) * 2010-01-25 2011-07-28 Fuji Xerox Co., Ltd. Computer readable medium for access right management, access right management apparatus and data processing system
US8893977B2 (en) * 2010-04-08 2014-11-25 Access Business Group International Llc Point of sale inductive systems and methods
US20110259960A1 (en) * 2010-04-08 2011-10-27 Access Business Group International Llc Point of sale inductive systems and methods
US9027840B2 (en) 2010-04-08 2015-05-12 Access Business Group International Llc Point of sale inductive systems and methods
US9424446B2 (en) 2010-04-08 2016-08-23 Access Business Group International Llc Point of sale inductive systems and methods
US9141633B1 (en) * 2012-06-27 2015-09-22 Emc Corporation Special markers to optimize access control list (ACL) data for deduplication
US9442725B2 (en) * 2013-08-21 2016-09-13 Airwatch Llc Branch trace compression
US20150058605A1 (en) * 2013-08-21 2015-02-26 Vmware, Inc. Branch trace compression

Similar Documents

Publication Publication Date Title
Mesnier et al. Object-based storage
Mohan et al. GUPT: privacy preserving data analysis made easy
US6480862B1 (en) Relation-based ordering of objects in an object heap
US6785822B1 (en) System and method for role based dynamic configuration of user profiles
US6917975B2 (en) Method for role and resource policy management
US6442584B1 (en) Methods for resource consolidation in a computing environment
Agrawal et al. Policy ratification
US7185192B1 (en) Methods and apparatus for controlling access to a resource
US20040162905A1 (en) Method for role and resource policy management optimization
US7251663B1 (en) Method and apparatus for determining if stored memory range overlaps key memory ranges where the memory address space is organized in a tree form and partition elements for storing key memory ranges
Burchard et al. New strategies for assigning real-time tasks to multiprocessor systems
US6981043B2 (en) Apparatus and method for managing multiple user identities on a networked computer system
US7496910B2 (en) System for policy-based management of software updates
US6714930B1 (en) Lightweight directory access protocol, (LDAP) trusted processing of unique identifiers
US20050015592A1 (en) System and method for application and user-based class of security
US20070100830A1 (en) Method and apparatus for access control list (ACL) binding in a data processing system
US6606627B1 (en) Techniques for managing resources for multiple exclusive groups
US20020026592A1 (en) Method for automatic permission management in role-based access control systems
US7650633B2 (en) Automated organizational role modeling for role based access controls
US20040243816A1 (en) Querying encrypted data in a relational database system
US20040083202A1 (en) Techniques to control recalls in storage management applications
US6449613B1 (en) Method and data processing system for hashing database record keys in a discontinuous hash table
US20040162906A1 (en) System and method for hierarchical role-based entitlements
US20020059286A1 (en) Trusted computing platform with dual key trees to support multiple public/private key systems
US20020166052A1 (en) System and methods for caching in connection with authorization in a computer system

Legal Events

Date Code Title Description
AS Assignment

Owner name: INTERNATIONAL BUSINESS MACHINES CORPORATION, NEW Y

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:KAO, I-LUNG;REEL/FRAME:009572/0720

Effective date: 19981102

REMI Maintenance fee reminder mailed
SULP Surcharge for late payment
FPAY Fee payment

Year of fee payment: 4

FPAY Fee payment

Year of fee payment: 8

REMI Maintenance fee reminder mailed
LAPS Lapse for failure to pay maintenance fees
FP Expired due to failure to pay maintenance fee

Effective date: 20130213